During the key exchange, EVP_PKEY_derive_set_peer() incorrectly validates the subgroup using the peer’s own q value instead of the local key’s q. A malicious peer can therefore supply a forged q equal to a small prime factor of the cofactor (r) and a public value Y whose order is r. Because the peer’s domain parameters are matched to the local key’s p and g but the q value is not compared, the bogus key passes all checks. The resulting shared secret then takes only r distinct values, exposing the victim’s private key modulo r. By repeating the exchange for each small‑prime factor of the cofactor and combining the results through the Chinese remainder theorem, an attacker can recover the full private DH key, a classic small‑subgroup confinement attack.

All OpenSSL FIPS modules up to and including 4.0, 3.6, 3.5, 3.4, 3.1.2, and 3.0 are affected. Systems that deploy X9.42 DHX static keys – commonly found in certificate‑management protocols and some government or enterprise applications – are directly exposed.

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating a very low probability of exploitation. The risk is limited to environments that use static X9.42 DHX keys with custom domain parameters; an attacker must actively engage in the key exchange with a malicious peer. Typical internet traffic is largely unaffected, and the CVSS score of 3.7 reflects low severity. However, in the narrow attack surface where the conditions are met, an attacker can recover the private DH key after only a few exchanges.